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^ Abstract 

"^ In this paper we present a new kind of unconditionally secure distributed 

CN election scheme, in which the voting administrator is made up by two parties 

,__, that will not cooperate up to cheat during the election. This scheme ensures 

i-^ that while the scheme is completed, nobody can threaten the privacy of the 

I election scheme even the administrator and the counter collaborate up to do 

C^ so for the first time, this has certain practical significance. The security and 
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implementability of this scheme depend on the security and implementability 

O^ of the quantum key distribution, and the practicability of this scheme reflects 

in that the election can also implements when the quantum channels exist 

^""^ loss and errors. 

> 
lO Keywords: quantum election, distributed scheme, conjugate coding 

in 

in 

o 

■• 1. Introduction 

■^ 

^r^ Suppose some voters want to vote in a large scale election scheme. The 

^ problem that most concerned by the voters is the privacy of the election. 

>■ That is, the eligible voter doesn't want anybody except himself/herself track 

KA his/her ballot at any time. In addition, security is also a much concerned 

H problem in an election scheme. This requires nobody can forge or tamper the 

ballots, so as to ensure the normal execute of the voting. In order to ensure 

the security and privacy at the same time, much attention has been paid 

to election schemes. These schemes can be divided to two parts: electronic 

election'^"^^] and quantum election'^'^"^^!. Homomorphic-encryption-based 
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scheme, Mix-net-based scheme and bhnd signature-based scheme are there 
main kinds of electronic voting schemes,these scheme can efficiently solve 
the drawback of achieving privacy and fairness at the same time. However, 
these schemes are based on public key cryptography and cannot provide 
unconditional security. 

Quantum cryptography can be used to solve the problem of unconditional 
security and privacy that mentioned in the former electronic voting schemes, 
which uses the fundamental laws of quantum physics to ensure unconditional 
security'^^"^^'. For example, we can use the quantum non-cloning theorem 
for unconditionally secure quantum key distribution '^^^^^J, and we can use 
quantum anonymous transmission t^^l to conceal the identity of the sender of 
the messages. Much attentions have been paid to quantum election proto- 
cols. In 2005 Vaccaro el al. proposed quantum election protocols through 
adding different local quantum operations to an entangled quantum state'^^1, 
and paper[14 — 16] presented similar protocols; the protocol in paper[17] uses 
fourier transform to execute voting, and does not need complicated mea- 
surements,but the protocol could not avoid the voters from cheating. In 
paper [31] we presented an election scheme based on anonymous quantum 
key distribution under scheme are semi- honest, which depended on the se- 
curity of the quantum key distribution to ensure unconditionally secure. In 
the semi-honest model the security of the election depends to much on the 
credibility the voting administrator and the counter, for the administrator 
may try to forge valid votes by personating the voters, and there is no reli- 
able way to solve the dispute between the administrator and the voters; in 
addition, the security will be threatened by the collusion of the administrator 
and the counter. To avoid this, we use a distributed scheme in this paper, 
in which several independent parties, e.g., several candidates of the election, 
collaborate to act as the voting administrator. 

We organize this paper as follows: in section 2 we present a traditional 
election scheme that uses the distributed scheme and analysis its security; 
in section 3 we present distributed anonymous quantum key distribution 
schemes that used in the quantum election scheme; further we present a 
quantum distributed election scheme in section 4; in section 5 we discuss the 
advantage of the new quantum election scheme; Finally, we make conclusion 
in section 6. 



2. Traditional distributed election scheme 

2.1. Preliminary 

In view of the properties that described in the literatures [3,5,8], a se- 
cure quantum election scheme is complete, if one ballot is valid, it should be 
counted; it is sound, so a dishonest voter cannot disturb the election; it is se- 
cret the ballots are invisible to the voting administrator; it is non-repeatable, 
no voter can vote successfully twice; it is fair, the former voters cannot affect 
the later voters; it is verified, the voter can check his ballot at the end of the 
election. We use IDi to represent the identity of the eligible voter Vi. 

We use the notation || to denote the concatenation of strings, Ek[M] 
denotes an unconditionally secure symmetric encryption algorithm and /(■) 
denotes an information secure one-way function: 

F{ai, hi) =ai®hi (1) 

where Oj, hi are bit strings with the same length. 

Durette et al. used the combination of the public key cryptography and 
multiple administrators to improve the security of the overall voting system 
by avoiding a single administrator forging valid votes in literature [32] , and 
paper [33] suggested both parties agree on a mutually at random selected 
key K and a commitment on this key to achieve information security. Based 
on this, an information security traditional distributed election scheme can 
be described as follows: 

As in the former paper, there are three parties in the scheme: the voters, 
the voting administrator Bob, and the counter Charlie. Specially, the voting 
administrator Bob is made up by multiple independent entities, for simplify, 
we assume it is made up by two independent entities Bohi,Boh2, who will not 
cooperate up to cheat. Before the voting, the voting administrator publishes 
a set 3^ C {0, 1}^. Each element of the set is a y-bit string that randomly 
chosen by Bob to represent an eligible candidate and Bob will announce the 
corresponding candidate of every element. 

The voting administrator establishes a secret number Tj to each eligible 
voter in advance. The secret number is visible to both Bohi and Boh2. 

2.2. Initial phase 

1. Vi applies for voting by sending his/her identity IDi along with the 
secret number r, to Bob. 



2. After getting V^'s request, Bob checks whether Vi has apphed for voting 
before, if he has. Bob rejects to respond his request; otherwise Bob checks 
whether r^ is correct, if it is correct, the scheme turns to the next step. 

3. Bobi and -B062 respectively estabhshes a secret string with Vi by di- 
rectly contacting or using an unconditionally secure quantum key distribution 
protocol, we denote the strings by 

Sa = Na\\Ta (2) 

^.2 = iV,2||T,2, (3) 

and Vi uses the function /(•) to generate 

N, = f{Na,N,2) (4) 

T, = /(Ta,T,2). (5) 

4. Bobi and Bob2 respectively establishes the secret strings Sn and Si2 
with Charlie by the same manner that used in the former step and Charlie 
also uses function /(■) to get the strings Ni and Tj. 

2.3. Voting and counting phase 

1. Vi chooses one candidate as his vote Vi and encrypts it by Ni, then he 
sends -EatJ^i] to Charlie along with Tj. 

2. When receives {Ti,Ei\f-[vi]), Charlie checks whether he has received Tj 
before, if not, he uses Tj to get the corresponding Ni that recorded in his 
database and decrypts -EatJ^j] to get the plaintext fj. After extracting Vi, 
Charlie checks whether Vi is correct, if the check succeeds, Charlie counts 
this vote. 

After all the votes has been count, Charlie publishes all the groups Tj,Wj 
for the eligible voter to check whether he/she has voted successfully. 
The scheme is now completed. 

2.4. Security analysis 

In this election scheme the voting administrator will check the identity of 
each voter before accept one voting request and reject to respond to one voter 
twice, and Charlie will check whether he has received Tj before counting Vi, 
so the eligibility and unreusability are satisfied; at the same time, the former 
voters' votes have no effect on the later ones, and all the eligible vote will be 
count correctly, so the fairness and completeness are satisfied; Charlie will 



check each ballot before count it, thus the soundness is guaranteed; at the end 
of the scheme Charlie will publish all the count ballot for each voter to check 
whether he/she has voted successfully, so the scheme satisfies the verifiability. 
The properties mentioned above are easy to prove, now we mainly discuss 
the privacy of the scheme. 

In this scheme two independent parties collaborate to act as the voting 
administrator, as the function /(■) is information security, the final commu- 
nication key string Ni and Tj between Vi and Charlie is invisible to others (the 
independent party Bobi and -B062 included). As long as one of the two parties 
reject to cooperate with another one, the communication key strings iVj,Tj 
are secure. However, the security of the protocol is difficult to achieve in the 
real life, because there is no effective way to guarantee that the two parties 
will not cooperate forever in practice. Whenever the two parties cooperate, 
the private of the election is damaged. An ideal election protocol should be 
information security and guarantee that the communication key strings are 
invisible to others at any time. 

3. Distributed anonymous quantum key distribution 

Considering the problem that mentioned in the traditional distributed 
election scheme, it is impossible to promise that two parties will not cooperate 
forever. However, According to common sense, in a real election we can think 
that there exists an oversight body to monitor the elections, this institution 
will supervise both sides within a certain period of time, so as to ensure 
that they cannot be cooperation within this time period. Based on this 
viewpoint, we assume the administrator is made up by two parties Bobi,Bob2, 
who cannot collaborate up to cheat during the scheme. When the scheme 
is complete, the private of the voter will not be damaged even if Bobi and 
Bob2 cooperate. 

Anonymous quantum key distribution(AQKD) can be used to ensure the 
private of the voter, if one voter can share a key string with Charlie anony- 
mously, he/she can easily encrypts his/her ballot anonymously. Once others 
cannot match the key string with the voter, they also cannot trace the ballot. 
In this section we present the distributed AQKD protocols that will be used 
in the new distributed quantum election schemes. 



3.1. Qubit-based distributed AQKD protocol 

Suppose one voter Vi wants to anonymously establish a key string with 
the counter Charlie with the help of the voting administrator Bob (made up 
by two independent parties Bobi,Bob2). The voter wants to ensure that 
nobody except himself/herself and Charlie can get the key string, which is 
difficult to achieve through traditional key distribution, because there is no 
reliable way to avoid others from copying the information. The quantum 
non-cloning theorem guarantees that it is impossible to measure or copy an 
unknown qubit without being detected. Based on this, we present a qubit- 
based AQKD protocol: 

Prerequisite: Bobi has established secret string Sa = (A^jill^ii) with Vi 
and Charlie, and -B062 has established secret string Si2 = (A^i2||^i2) with 
Vi and Charlie. Both Vi and Charlie computes Ni = f{Nii,Ni2), Ti = 
/(Ta,T,2). 

Step 1 Vi randomly chooses a string Ri G {0,1}™", and generates his 
qubits \ai) by the method of conjugate codingt^"^!: 

\a,) = H'^^R,) = ^f^^iN'^'lRi)) (6) 

where N^ ,^1 denote the j-th bit of Ni,Ri, and H^^ = 0™ li/^s H^ = I = 

I l)'''' = ''=i^[l -1 

After doing that, Vi anonymously transmits the quantum state \ai) with 
the secret string Ti to Charlie. 

Step 2. Charlie checks whether he has received Tj before, if not, he uses 
Ti to get the corresponding string N^, and measures the quantum state \ai) 
depending on the value of Nii if N^ =0, he measures the qubit \al) with the 
rectilinear basis {|0), |1)}; otherwise he measures it with the diagonal basis 
{!+)) I~)}- After getting the outcome, Charlie pubhshes a subset of the 
outcome with Tj and all the location information of the bits of the subset, 
we denote the subset by o"j. 

Step 3. Vi checks whether the subset ctj is equal to the corresponding 
subset of Ri, if it is, Vi knows that the quantum key distribution is successful, 
he/she deletes the checking bits ai and extracts the remaining bits of Ri as 
the final encrypted key string 

Ki = Ri - a, = KiL\\KiR. (7) 

Now Vi has anonymously established a key string Ki with Charlie. 
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Security analysis 

In this protocol we assume that Bobi,Bob2 will not cooperate until the 
protocol is complete, and the function /(■) is information security, thus nei- 
ther Bobi nor Bob2 can get the strings Ni or Tj during the AQKD protocol. 
The quantum state \ai) is an unknown quantum state to others (-B061, -B062 
included), so it is impossible to make a copy. A malicious entity has to 
measure the initial qubits if he wants to get some useful information about 
the final encryption key string. However, without the encoding basis of the 
qubits, he will choose the wrong measuring basis with the probability 50% 
for each qubit, then introduce no less than 25% error rate in Charlie's mea- 
suring outcome. That means without Tj it is impossible to make a correct 
measurement on the quantum state \ai), and an incorrect measurement will 
affect Charlie's measuring outcome and be detected by Vi in the last step of 
the anonymously key distribution phase and Vi then will break the scheme. 
As a result, nobody except Vi and Charlie can get the final encryption key 
string Ki. The probability that others except Vi and Charlie guess the cor- 
rect X-bit key string Ki is not more than (^)^, when x is large enough, the 
probability is negligible. In one word, when the anonymous key distribution 
phase is complete, their is no effective way for Bobi and B062 to get the final 
encryption key string even if they cooperate. 

Practicability analysis 

Considering the problem that mentioned in the traditional distributed 
election scheme, we just assume the two independent entities Bobi and -B062 
will not cooperate for a limited time(just limited until to the ending of the 
AQKD protocol), that is reasonable and easy to achieve in practice. 

This AQKD protocol can also work even if there exist loss and errors 
in quantum channels. In order to establish an error-free key, Charlie can 
publish all the qubits that he has received, then publish the check string 
and its serial numbers in step 2 of the anonymous key distribution phase. If 
the error rate of the check string is acceptable, Vi can make sure that the 
key distribution is successful. After verifying that the key distribution is 
successful, Vi extracts the string Ki from Ri and subsequently uses Ki and 
a key redistribution protocol^^^l to establish the final error-free key and then 
use the error-free key to encrypt his/her ballot'^^'. 

3.2. Qubit-string-based distributed AQKD protocol 

The former qubit-based distributed AQKD protocol efficiently avoid Bob 
from cheating by personating the voters. The combination of anonymous 



quantum key distribution and distributed scheme guarantees the private of 
the voter. When the protocol is completed, neither Bobi nor Bob2 can get the 
final encrypted key string even if they collaborate to cheat. However, there is 
a further problem: in the scheme Bob and Charlie should be two independent 
parties that will never cooperate. Once the two parties cooperate up, the 
privacy of the voter is not guaranteed. An ideal AQKD prococol should 
make sure that once the protocol is completed nobody can break the private 
of the voter even if the voting administrator and the counter cooperate up 
to do so. 

A qubit-string-based scheme can be used to solve this problem. The 
improved AQKD protocol is as follows. 

Prerequisite: Bobi and Bob2 respectively establish specific key strings 
with Vi, we denote the key strings by Ni, L1N2, L2; at the same time, Bobi 
and Bob2 respectively establish a specific key string with Charlie, we denote 
the two strings by KiK2. Here 

Ki = Si\\Mi\\Ni\\Li, K2 = S2\\M2\\N2\\L2. (8) 

where 

Ni,N2 G {0,ir,Mi,M2 G {0,l}',Li,L2 G {0,1}' (9) 

5i = (ai,a2,---,az) = (ai,---,ar,---,az,---,ane{0,iy™ (10) 

S2 = {bi,b2r-- A) = {blr-- ,bT,--- Mr-- ,bT)e{0,iy"'. (11) 

Step 1. Bobi and Bob2 respectively use the random number generater 
to prepare a random string 

Ri = {ci,C2,---,ci) = {cl,---,cT,---,cj,---,cr)e{0,iy"^ (12) 
R2 = {di,d2, ■■■ ,di) = {d\, ... ,dT,--- ,dl--- ,dr)e {0, 1}"" (13) 



where 



cj © c| © ■ ■ ■ © cf = Mj', < J < / + 1 (14) 

dl ® d'^^ ® ■ ■ ■ ® dT = M'^,0 < i < I + 1 (15) 

and collaborate to generate a quantum state \ai) by using cojugate coding: 

-6?)' h''' Y'^' H"' \r-) ^^^^ 



Here the subscript Bobi and Bob2 of H and Y denotes the operator of the 
ro _ r _ ^ 1 ^ ^1 _ ^ _ 1 ^1 1 



operation, and if" = / = ( ^ 1 , if ^ = if = — ( _^ ] ,¥" 
' '^ Y^ = Y='('^ -} 1 thatis: 
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ii|0) = |+),ii|l) = |-),ii|+) = |0),ii|-) = |1); (17) 

F|0) = |l),r|l) = |0),F|+) = |-),F|-) = |+). (18) 

Then Bob sends the quantum state to Vi via a secure quantum channeL 

Step 2. After receiving \ai), Vi uses the random number generator to 
generate a random string Pj G {0, 1}'™, Ki G {0, 1}'-™- ^ where 

P, = (ei,e2,---,Q) = (e},---,er,---,e^---,en; (19) 

and 

ej © e^2 © ■ ■ ■ © ef = 0, for < J < / + 1, (20) 

then he/she computes 

N = /(iVi, iV2), L = f\L^, L2),T, = El[K,\\N]. (21) 

Step 3. For every subset \aij) of the quantum state \ai), where j G 
{1, 2, ■ ■ ■ , /} throughout, Vi randomly choose a qubit |Q;fj)(kG {1, 2, ■ ■ ■ , m}) 
and add an operation hke that 

14)' = ^"^14) (22) 

Now 

!«..)' = 14) ® ■ ■ ■ ® 14"') ® 14)' ® 14''') ® ■ ■ ■ ® 14) (23) 

After doing that, Vi generates 

\a,)" = Y'^laaY © Y^' {0,2)' © ■ ■ ■ © F^' |«.z)' (24) 

Then l^j sends |ai)" to Charhe anonymously via a secure quantum channel. 
Step 4. Charlie computes M = /(Mi,M2), A^ = /(A^i,A'2), S = 
f{Si,S2), L = f{Li,L2) in advance. When receives \ai)", Charlie measures 
it depending on the value of the string S: if S^ = 0, he measures the qubit 
|q;|)" with the rectilinear basis {|0), |1)}, where jG {1, 2, ■ ■ ■ , Im} throughout; 



otherwise he measures it with the diagonal basis {|+), |— )}• After getting 
the outcome {Ri © -R2)', where 

(R, © R,y = (r-l', rt ■ ■ ■ , < , ■ ■ ■ , r]\ ■ ■ ■ , rf) (25) 

Charhe computes M' with 

M; = ri'©.--©rr',^ = l,2,---,/ (26) 

and uses the string M to extract 

T = M®M' (27) 

and gets i^^'HA^' by decrypting T/ with the key L. Then he checks whether N' 
is correct, if the check succeeds, Charhe can make that he gets the correct 
key string Ki. 

Security and practicability analysis 

In this protocol we use m-qubits to transmit one key bit, the quantum 
state \ai)" has been randomed by V^ (through the operation that based on 
the value of Pi) so the voting administrator and the counter cannot match 
the key string Ki with the voter VJ even if they collaborate up to do so. 

When there exists loss and errors in quantum channels, we can improve 
the protocol as follows: 

In the voting phase, Vi uses the random number generator to generate a 
random number 

P, = (ei,e2,---,eO = (e},---,er,---,e^---,en (28) 

then uses a classic error correction coding(ECC) to encode it and get the 
corresponding code Di. 

When receives the qubits \ai) from Bob, Vi adds an operation like that: 

!«,)' = ©,F^^|a^) (29) 

Vi adds Y^'^ to \q.*) only if he receives this qubit. After doing that, V^ 
generates the key string pj, where 

p'i =e]®e]®---® ef , J = 1, 2, ■ ■ ■ , / (30) 

then he sends \a.i)' to Charlie along with the serial numbers of the qubits 
that he/she receives from Bob. Charlie measures the qubits and extracts the 
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code D[ = DiO) e, he uses D'- to recover the string Pi and further generates 
the key string pi. A dishonest voter or the attacker may also try to forge a 
ballot. As they are not aware of the string S and M, so they will introduce 
no less than 75% error rate in the string D'^, while the error correction ability 
of the ECC is not available to correct such a large error rate, it is impossible 
to recover the string Pj. 

4. Quantum distributed election schemes 

A complete voting process in our quantum election scheme includes four 
phases: initial phase, anonymous quantum key distribution phase, voting 
phase and counting phase. Several voters Vj, j=l,2,- ■ ■ ,N, the voting ad- 
ministrator Bob (made up by two independent parties Bobi,Bob2), and the 
counter Charlie are also involved. 

If Bob and Charlie are two independent parties that will not collaborate 
forever, we can use both the qubit-based distributed AQKD protocol and the 
qubit-string-based AQKD protocol that presented in section 2; in order to 
ensure that the private of the voter will not be threaten by the collaborate 
up of the voting administrator Bob and the counter Charlie forever, we use 
the qubit-string-based AQKD protocol in our distributed quantum election 
scheme. 

4.I. Initial phase 

Bobi and -B062 respectively establish a specific key string with every el- 
igible voter, we denote the key strings by Ni,LiN2,L2, and send a random 
number generator to every eligible voter to generate the random number that 
used in the protocol; at the same time, Bobi and Bob2 respectively establish 
a specific key string with Charlie, we denote the two strings by KiK2- Here 



K^ = Sl\\M^\\N^\\L^,K2 = S2\\M2\\N2\\L2. (31) 



where 



N,, N2 e {0, ir. Ml, Li, M2, L2 e {0, 1}', 

Si = (ai, 02, ■ ■ ■ , ai) = (a}, ■ ■ ■ , a^, ■ ■ ■ , a;\ ■ ■ ■ , a[") G {0, 1}'" 
S2 = {bi,b2r--A) = {bl---,bTr--Mr--,bT)e{0,iy"'. 
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4-2. Anonymous key distribution phase 

In this phase each ehgible voter Vi anonymously estabhshes a encrypted 
key string Ki = KiLWKm with the counter Charhe by using the qubit-string- 
based AQKD protocol, the key string is used for encrypting the ballot and 
it is invisible to otheTs{Bobi,Bob2 included) except for Vi and Charlie. 

After all the voters anonymously establish key strings with Charlie, the 
scheme turns to the voting phase. 

4-3. Voting and counting phase 

1. Vi chooses one candidate as his vote Vi and encrypts it with Ki, then 
he sends Ex^^lvi] to Charlie along with Ki^. 

2. After receiving {KiL, Exuilvi]), Charlie checks whether he has received 
Eru^ before, if the check succeeds, Charlie uses Kn to extract the corre- 
sponding Kiji, then he decrypts Exii^lvi] to get the ballot Vi. If the outcome 
Vi is eligible, Charlie counting this vote. 

After all the votes has been count, Charlie publishes all the groups {E^.j^ , Vi 
for the eligible voter to check whether he/she has voted successfully. 
The scheme is now completed. 

4-4- Security and practicability analysis 

Security analysis For any two voters Vi and Vj, Bob respectively sends 
a quantum state \ai) and \aj) to them. We denote 

\(^^) = Hll,Y^XH'^X\R,) (32) 

\^,) = H'^ltyBiHt,,\R[) (33) 

For simplify, we consider the first subset {an) and \aji) of the two quantum 
states. As the strings Ri,R'i,R2,R2 are chosen under the condition that 

M(,0<j <l + l (34) 

= M^, < j < / + 1 (35) 

we denote the function F{-) to compute the XOR of a bit string, then the 
density matrix of {an) and \aji) can be written as 

^^1 = ^ E ^"l-i) (36) 

-.1 = ^ E ^"K) (37) 

F(r'i)=Mi 
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c] © c^ © ■ 


■ ■ © cf 


= c? © f © ■ ■ 


■ © c'p 


d] © o?| © ■ • 


' ■ © rff 


= < ®df®- 


■■(Bd'p 



where 

ri = ci © rfi, r[ = c[ © d[ (38) 

si = ai © 61, M^ = Ml © M^ (39) 

Now we can see that the two density matrix are the same, the voter cannot 
distinguish between {an) and \aji). In the same way we can prove that the 
voter cannot distinguish between \ai) and \q:j). Thus the voters cannot get 
any information about the strings Ri,R2,Si and S2. 

According to the quantum no-cloning theorem it is impossible to copy an 
unknown quantum state without the preparation basis of the state. Once 
an attacker wants to forge a valid ballot, he has to prepare a quantum state 
and sends it to Charlie. As the quantum state is randomly prepared, Charlie 
will get the correct value of each bit of A^^' with the probability 50%, so the 
probability that a forged quantum state passes Charlie's identity check is not 
more than (|)^, while x is large enough, the probability is close to 0. So an 
attacker has to get the information of the state preparation basis, that is, 
get the value of the string S. 

Suppose several voters collaborate up to guess the string S. For example, 
we consider the first m bits of S. Suppose n voters collaborate to guess these 
m bits. A subset (for example, the number is m) of them guess a random 
m-bit string and uses it to measure the first m-qubit of their quantum state 
that received from Bob. After getting the outcome every voter computes the 
XOR of all the m bits of his/her outcome. If all the m voters get the some 
value, they believe that the string that they choose is correct, otherwise they 
think the string is wrong. The probability that the m voters get the same 
XOR value is 

Pi = -^ (40) 

so they can exclude a wrong string with probability 

P2 = 1 - Pi = 1 ^—r. (41) 

While m is large enough, the probability is close to 1. After excluding an 
invalid string, another m voters can exclude another wrong string with prob- 
ability P2 in the same manner. In order to get the correct S, the voters has to 
exclude all the wrong strings. That needs at least (2"* — l)*m voters collab- 
orate up. While the number of the voters is far less than that number, it is 
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impossible to get the correct S even if all the voters collaborate up to get it. 
Therefore, the voters cannot disturb the election and it is impossible to forge 
a valid vote. No voters can vote twice. The soundness and unreusability are 
guaranteed. 

Charlie will check the identity of the voter before count his ballot, so 
only eligible voters are permitted to vote. When the protocol is completed, 
nobody can destroy the privacy of the scheme. As the quantum state \oii)" 
has been randomized by Vi before sending to Charlie, the density matrix 
of any two voters' qubits |q;j)" and \aj)" are the same so nobody(Bob and 
Charlie included) can distinguish between them. In addition, the string Qi 
is randomly chosen by V^, Charlie cannot match the ballot Vi with the voter 
Vi even if he collaborates with Bobi and Boh2. So the eligibility and privacy 
are guaranteed. 

In this scheme Charlie will publish the result of the election for every voter 
to check his/her ballot at the end of the scheme, the former voters has no 
effect on the later voters. So the scheme is fair to all the voters. As the voting 
administrator and the counter are monitored during the election, they should 
be honest, otherwise they will be detected. Hence the verifiability, fairness 
and completeness are guaranteed. 

As the qubit-string based AQKD protocol can resists the loss and errors of 
the quantum channels, so the distributed quantum election scheme can works 
well when the quantum channels exist loss and errors. The only request 
in this scheme is the existence of the oversight body that monitored the 
participants of the election during the protocol, with such a body neither 
the voting administrator nor the counter can cheat during the election, that 
ensures the security of the scheme. 

5. Discussion 

Considering the problem that mentioned in the former papers, we present 
a new kind of unconditionally secure distributed election scheme based on 
the anonymous quantum key distribution, in which the voting administra- 
tor is made up by independent entities that cannot cooperate up to cheat 
during the election. The security of the distributed election scheme is based 
on the security of the anonymous quantum key distribution protocol, which 
depends on the quantum key distribution to ensure the unconditionally secu- 
rity. Once one voter anonymously establishes a key string with the counter, 
nobody can match him/her with his/her ballot, for the ballot is encrypted 
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by the key string, and it is impossible to trace the key string in the anony- 
mous quantum key distribution. The distributed scheme is used for avoiding 
the threat of the collaborate up of the voting administrator and the counter. 
Considering the definition of covert security that discussed in Paper t^^^, a 
protocol with covert security can guarantees that the honest party will no- 
tice the cheating attempt of the adversary with constant probability. In this 
distributed quantum election scheme, the security of the voting depends on 
the security of quantum key distribution, as the voting administrator is made 
up by some entities that will not cooperate to cheat during the voting, the 
dishonest attempt of any member of the voting administrator will be de- 
tected by the voter in the anonymous quantum key distribution phase; at 
the same time, the dishonest attempt of the counter will be detected in the 
final counting phase, so neither the voting administrator nor the counter can 
cheat successfully without being detected, and the probability that the voter 
detects the dishonest behaviors is close to 1, the scheme satisfies information 
covert security. 

Compared with the traditional distributed election scheme that men- 
tioned in section 2, the scheme can not only efficiently solve the dispute 
between the voter and the administrator, but also solves the difficulty of 
monitoring the independent parties forever. In the new scheme we just as- 
sume there exists an oversight body to monitor the two entities during the 
election, then to guarantee the security and privacy of the election. While the 
scheme is completed, nobody can match the key string and the correspond- 
ing voter even if the administrator and the voter collaborate to do so, so it 
is impossible to track the ballot. This distributed quantum election scheme 
can ensures the completeness, soundness, privacy, eligibility, unreusability, 
fairness and verifiability of a large scale election at the same time, even a 
malicious voting administrator or counter cannot destroy the privacy of the 
election. In addition, the new distributed quantum election scheme is more 
easier to implement because we don't use quantum entanglement and quan- 
tum storage. 

6. Conclusion 

In this paper we construct new kinds of unconditionally secure election 
schemes, which enhance the security and privacy of the election by the com- 
bination of anonymous quantum key distribution and a distributed scheme. 
The distributed scheme can efficiently avoid others, especially a malicious 
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voting administrator or counter, from personating the eligible voters or trac- 
ing the ballots. As long as the two parties that made up the administrator 
cannot cooperate up to cheat before the ending of the election, the security 
and the privacy of the election are guaranteed. When the election is com- 
pleted, nobody can threaten the privacy of election scheme. The distributed 
quantum election scheme can also works when the quantum channels exist 
loss and errors. 
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